CVE-2025-43798

Published: Sep 15, 2025Modified: Jun 17, 2026

2.1

Vector

CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XShow less

Source: security@liferay.com (Secondary)

Description

Liferay DXP 2023.Q4.0, 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92 and 7.3 GA through update 35 allows a time-based one-time password (TOTP) to be used multiple times during the validity period, which allows attackers with access to a user’s TOTP to authenticate as the user.

Affected (44)

Products: Liferay: Digital Experience Platform

Liferay

1 product

Digital Experience Platform

Configuration A

44 vulnerable

Vulnerable Software	Affected Versions
Liferay Digital Experience Platform	From 2023.q3.1 to 2023.q3.5
Liferay Digital Experience Platform	Version 2023.q4.0
Liferay Digital Experience Platform	Version 7.3
Liferay Digital Experience Platform	Version 7.3 fix_pack_1
Liferay Digital Experience Platform	Version 7.3 fix_pack_2
Liferay Digital Experience Platform	Version 7.3 service_pack_1
Liferay Digital Experience Platform	Version 7.3 service_pack_2
Liferay Digital Experience Platform	Version 7.3 service_pack_3
Liferay Digital Experience Platform	Version 7.3 update10
Liferay Digital Experience Platform	Version 7.3 update11
Liferay Digital Experience Platform	Version 7.3 update12
Liferay Digital Experience Platform	Version 7.3 update13
Liferay Digital Experience Platform	Version 7.3 update14
Liferay Digital Experience Platform	Version 7.3 update15
Liferay Digital Experience Platform	Version 7.3 update16
Liferay Digital Experience Platform	Version 7.3 update17
Liferay Digital Experience Platform	Version 7.3 update18
Liferay Digital Experience Platform	Version 7.3 update19
Liferay Digital Experience Platform	Version 7.3 update1
Liferay Digital Experience Platform	Version 7.3 update20
Liferay Digital Experience Platform	Version 7.3 update21
Liferay Digital Experience Platform	Version 7.3 update22
Liferay Digital Experience Platform	Version 7.3 update23
Liferay Digital Experience Platform	Version 7.3 update24
Liferay Digital Experience Platform	Version 7.3 update25
Liferay Digital Experience Platform	Version 7.3 update26
Liferay Digital Experience Platform	Version 7.3 update27
Liferay Digital Experience Platform	Version 7.3 update28
Liferay Digital Experience Platform	Version 7.3 update29
Liferay Digital Experience Platform	Version 7.3 update2
Liferay Digital Experience Platform	Version 7.3 update30
Liferay Digital Experience Platform	Version 7.3 update31
Liferay Digital Experience Platform	Version 7.3 update32
Liferay Digital Experience Platform	Version 7.3 update33
Liferay Digital Experience Platform	Version 7.3 update34
Liferay Digital Experience Platform	Version 7.3 update35
Liferay Digital Experience Platform	Version 7.3 update3
Liferay Digital Experience Platform	Version 7.3 update4
Liferay Digital Experience Platform	Version 7.3 update5
Liferay Digital Experience Platform	Version 7.3 update6
Liferay Digital Experience Platform	Version 7.3 update7
Liferay Digital Experience Platform	Version 7.3 update8
Liferay Digital Experience Platform	Version 7.3 update9
Liferay Digital Experience Platform	Version 7.4

Related CWEs

CWE-304

Missing Critical Step in Authentication

The product implements an authentication technique, but it skips a step that weakens the technique.

References (1)

https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-43798

Source: security@liferay.com

Vendor Advisory

Timeline

No history available yet.